fix(review): give score-breakdown.ts its own vocabulary instead of the public sanitizer

[JSONbored]

Summary

src/services/score-breakdown.ts's explainScoreBreakdown() piped its own contributor-facing "explain my score" copy through sanitizePublicComment (src/github/commands.ts), the shared sanitizer for genuinely public GitHub comment surfaces (@loopover mention-command replies, etc.).

This endpoint (POST /v1/scoring/explain-breakdown, and the matching MCP tool) is gated by requireContributorAccess — an authenticated, per-contributor "explain your own score" surface, not a public GitHub comment. Its copy legitimately and pervasively says "score" and "credibility" by design. Reusing the public sanitizer mangled its own output: "saturated near the score cap" → "saturated near the private context cap", "Contributor credibility evidence..." → "Contributor private context evidence...".

Gives score-breakdown.ts its own small, local, curated sanitizer — keeping only a token/local-filesystem-path safety net (this endpoint's output is entirely computed, structured score data, so that's the only genuine residual risk) — instead of the full gittensor-economic-vocabulary substitution. Mirrors the established, documented pattern already used by agent-action-explanation-card.ts / miner-dashboard-recommendations.ts (see src/signals/redaction.ts's note above PUBLIC_UNSAFE_TERMS).

Unblocks a planned follow-up: now that this file no longer depends on sanitizePublicComment, that shared sanitizer can safely add bare-score redaction (already added to queue-intelligence.ts's sanitizer in #6460) without breaking this feature — closing a gap that PR deliberately left open for exactly this reason.

Test plan

• New regression test asserting the feature's own core vocabulary (score/credibility) survives byte-for-byte, not just "no forbidden wallet/hotkey word leaked"
• All 25 existing/new tests in test/unit/score-breakdown.test.ts pass; score-breakdown.ts at 100% line/branch coverage (one pre-existing, unrelated branch gap noted, not introduced by this change)
• Full local gate (npm run test:ci) green

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

❌ 3 Tests Failed:

Tests completed	Failed	Passed	Skipped
17244	3	17241	13

View the top 3 failed test(s) by shortest run time

test/unit/backfill.test.ts > GitHub backfill > marks comment, label, and check repair impacts disabled by repo settings

Stack Traces | 0.521s run time

AssertionError: expected { metadata: 'read', …(3) } to not have property "contents"

- Expected:
undefined

+ Received:
"write"

 ❯ test/unit/backfill.test.ts:1203:44

test/unit/backfill.test.ts > GitHub backfill > repair diagnostics require contents:write for merge autonomy (#audit-install-health display)

Stack Traces | 0.549s run time

AssertionError: expected 'write' to be 'read' // Object.is equality

Expected: "read"
Received: "write"

 ❯ test/unit/backfill.test.ts:1267:54

test/integration/api.test.ts > api routes > serves installation repair diagnostics and refreshes installation health

Stack Traces | 0.967s run time

AssertionError: expected { …(11) } to match object { installation: { …(3) }, …(3) }
(8 matching properties omitted from actual)

- Expected
+ Received

@@ -17,8 +17,8 @@
      "path": ".../777/repair/refresh",
    },
    "requiredPermissions": {
      "issues": "write",
      "metadata": "read",
-     "pull_requests": "read",
+     "pull_requests": "write",
    },
  }

 ❯ test/integration/api.test.ts:2195:24

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}